Keepalive Timeout Vulnerability in Python AIOHTTP Package
Summary
DEBIAN-CVE-2026-111064: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Affects python-aiohttp versions 3.10.0-1 – 3.9.5-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is an asynchronous HTTP client/server framework designed for asyncio and Python. It allows developers to build web applications and services that can handle multiple requests simultaneously, making it a popular choice for modern web development. However, prior to version 3.14.4, AIOHTTP had a significant vulnerability related to keepalive timeout handling, which could be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the absence of proper keepalive timeout handling during the initial phase of a request. An attacker can exploit this by keeping an idle connection open indefinitely before sending any request data. This behavior can lead to resource exhaustion on the server, as it consumes connection capacity and may degrade the performance of the application, potentially leading to denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement connection limits on your server to mitigate the impact of this vulnerability. This can be done by configuring your web server to limit the number of simultaneous connections or by using a reverse proxy that can handle connection management more effectively.
Conclusion
The keepalive timeout vulnerability in the AIOHTTP package poses a significant risk to applications using this framework. By updating to the latest version and implementing connection management strategies, developers can protect their applications from potential exploitation.
See every vulnerability recorded for python-aiohttp →
FAQ
AIOHTTP is an asynchronous HTTP client/server framework for Python that allows developers to build web applications and services that can handle multiple requests concurrently.
The vulnerability allows an attacker to keep an idle connection open indefinitely, consuming server resources and potentially leading to denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Update the AIOHTTP package to version 3.14.4 or later to patch the vulnerability. Additionally, consider implementing connection limits as a temporary workaround.
Detailed information about the vulnerability can be found in the official CVE report and on platforms like Vulert, which provides real-time monitoring for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-aiohttp.
